The report uncovered an abundance of confidence in risk awareness and capabilities. But are senior stakeholders overstating their organization’s risk prowess? The results of this survey show companies can use risk management to not only protect value, but as a competitive advantage to power performance. In fact, nearly nine in 10 survey respondents believe value creation should be a key focus of risk management, yet only one in five are taking the steps needed to implement the obvious improvements. And three out of five say their organizations are susceptible to the profound forces of innovation and disruption which the global business landscape faces today. This report explores these gaps and how organizations can use risk to create as well as protect value.

“Historically, risk management has been a reactive or check-the-box exercise,” said Sam Balaji, Deloitte Global Risk Advisory Leader. “Companies are beginning to elevate and closely link the risk conversations to business strategy and drive superior performance; senior executives are now becoming more proactive and deliberate in assessing risks and utilizing them to differentiate and create value in addition to protecting value.”

Elevating the CRO to a business partner

In order for organizations to build closer alignment between value creation and risk, the role of the Chief Risk Officer (CRO) should be elevated to increase synergy between boards, C-suite executives and CROs.

As the role of the CRO is increasingly seen as a business partner moving forward, 58 percent of respondents say their CROs should spend significantly more time performing the strategist role in which they participate in setting the strategic direction of the company and align risk management strategies accordingly.

Key themes revealed by the survey include:

Companies need to build closer alignment between value creation and risk: Organizations whose risk management philosophies and programs focus on value creation cite a range of areas where their actions are delivering significant benefits. These areas include customer loyalty, increasing operational resilience, improving cost effectiveness, and identifying and exploiting new business opportunities.

Companies need to do more to establish and optimize the role of the CRO: A majority of business leaders surveyed–63 percent–state that the firms they represent have a full-time CRO, with an additional 24 percent stating they believe the role is being performed by another executive. However, research suggests that organizations may not be defining this critical role accurately, or benefiting from it fully.

Companies must forge responses to their most strategic risks and opportunities: Companies say they are focusing on a wide array of both emerging and longstanding strategic and tactical risks–but are these the right issues? With only 17 percent of respondents citing cybersecurity and 9 percent viewing geopolitical issues in the top three risks to their business, it is crucial that organizations do not lose sight of these risks and opportunities at the perimeter.

In such a volatile and uncertain era, Deloitte Global believes that companies cannot afford overconfidence. “Business leaders should recalibrate and fortify their risk management programs to ensure strong alignment with business strategy, linking them to value creation and differentiation. Given the pace of change and these findings, it is clear that a healthy dose of self-reflection accompanied by concrete action is imperative to harness the power of risk management to achieve market leadership,” said Balaji.

Forbes Insights, on behalf of Deloitte Touche Tohmatsu Limited, surveyed more than 300 C-level or board representatives excluding CROs across the Americas, EMEA and Asia/Pacific regions between November and December 2016. Key industries surveyed include Consumer & Industrial Products, Life Sciences & Health Care, Financial Services, Manufacturing, Energy & Resources and Technology, and Media & Telecommunications. The survey sampled a range of companies from USD$1 billion in revenue and up, including 23 percent over USD$20 billion. Interviews were conducted with three CEO/board level executives as well as a CRO to provide editorial perspective and interpretation of the survey findings.

About Deloitte

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see www.deloitte.com/about to learn more about our global network of member firms.

Deloitte provides audit, consulting, financial advisory, risk advisory, tax and related services to public and private clients spanning multiple industries. Deloitte serves four out of five Fortune Global 500® companies through a globally connected network of member firms in more than 150 countries bringing world-class capabilities, insights, and high-quality service to address clients’ most complex business challenges. To learn more about how Deloitte’s approximately 245,000 professionals make an impact that matters, please connect with us on Facebook, LinkedIn, or Twitter.

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. Please see About Deloitte to learn more about our global network of member firms.